1. Stream Cipher
July 2011

2. Topics One-Time-Pad Random Number Generator Stream Cipher RC4
RC4 and WEP

3. One-Time Pad
Developed by Gilbert Vernam in 1918, another name: Vernam Cipher
The key
a truly random sequence of 0’s and 1’s
the same length as the message
use one time only
The encryption
adding the key to the message modulo 2, bit by bit.
Encryption
Decryption
mi : plain-text bits.
ki : key (key-stream ) bits
ci : cipher-text bits.

4. Example Encryption: 1001001 1000110 plaintext 1010110 0110001 key
ciphertext
Decryption:
ciphertext
plaintext

5. One-Time pad practical Problem
Key-stream should be as long as plain-text
Difficult in Key distribution & Management
Solution :
Stream Ciphers
Key-stream is generated in pseudo-random fashion form Relatively short secret key

6. Stream Cipher Model Output function appears random Si+1 Si
Si : state of the cipher
at time t = i.
F : state function.
G : output function. F G
Initial state, output and state
functions are controlled by the
secret key. ki mi ci

7. Random Numbers In all cases its critical that these values be
Many uses of random numbers in cryptography
Nonce as Initialize Vector
Session keys
Public key generation
Keystream for a one-time pad
In all cases its critical that these values be
statistically random, uniform distribution, independent
unpredictability of future values from previous values
Care needed with generated random numbers
Random numbers play an important role in the use of encryption for various network security applications. In this section, we provide a brief overview of the use of random numbers in cryptography and network security and then focus on the principles of pseudorandom number generation. Getting good random numbers is important, but difficult. You don't want someone guessing the key you're using to protect your communications because your "random numbers" weren't (as happened in an early release of Netscape SSL). Traditionally, the concern in the generation of a sequence of allegedly random numbers has been that the sequence of numbers be random in some well-defined statistical sense (with uniform distribution & independent). In applications such as reciprocal authentication, session key generation, and stream ciphers, the requirement is not just that the sequence of numbers be statistically random but that the successive members of the sequence are unpredictable (so that it is not possible to predict future values having observed previous values). With "true" random sequences, each number is statistically independent of other numbers in the sequence and therefore unpredictable. However, as is discussed shortly, true random numbers are seldom used; rather, sequences of numbers that appear to be random are generated by some algorithm.

8. Topics One-Time-Pad Random Number Generator Stream Cipher RC4
RC4 and WEP

9. Pseudorandom Number Generators (PRNGs)
Often use deterministic algorithmic techniques to create “random numbers”
although are not truly random
can pass many tests of “randomness”
Known as “Pseudorandom Numbers”
Created by “Pseudorandom Number Generators (PRNGs)”

10. Random & Pseudorandom Number Generators
Stallings Figure 7.1 contrasts a true random number generator (TRNG) with two forms of pseudorandom number generators. A TRNG takes as input a source that is effectively random; the source is often referred to as an entropy source. In contrast, a PRNG takes as input a fixed value, called the seed, and produces a sequence of output bits using a deterministic algorithm. Typically, as shown, there is some feedback path by which some of the results of the algorithm are fed back as input as additional output bits are produced. The important thing to note is that the output bit stream is determined solely by the input value or values, so that an adversary who knows the algorithm and the seed can reproduce the entire bit stream.
Figure 7.1 shows two different forms of PRNGs, based on application;
• Pseudorandom number generator: An algorithm that is used to produce an open-ended sequence of bits is referred to as a PRNG. A common application for an open-ended sequence of bits is as input to a symmetric stream cipher, as discussed in Section 7.4. Also, see Figure 3.1a.
• Pseudorandom function (PRF): A PRF is used to produced a pseudorandom string of bits of some fixed length. Examples are the symmetric encryption keys and nonces. Typically, the PRF takes as input a seed plus some context specific values, such as a user ID or an application ID.

11. PRNG Requirements Randomness Unpredictability
uniformity, scalability, consistency
Unpredictability
forward & backward Unpredictability
use same tests to check
Characteristics of the seed
Secure
if known adversary can determine output
so must be random or pseudorandom number

12. Using Block Ciphers as PRNGs
For cryptographic applications, can use a block cipher to generate random numbers
Often for creating session keys from master key
CTR
Xi = EK[Vi]
OFB
Xi = EK[Xi-1]
A popular approach to PRNG construction is to use a symmetric block cipher as the heart of the PRNG mechanism. For any block of plaintext, a symmetric block cipher produces an output block that is apparently random. That is, there are no patterns or regularities in the ciphertext that provide information that can be used to deduce the plaintext. Thus, a symmetric block cipher is a good candidate for building a pseudorandom number generator. If an established, standardized block cipher is used, such as DES or AES, then the security characteristics of the PRNG can be established. Further, many applications already make use of DES or AES, so the inclusion of the block cipher as part of the PRNG algorithm is straightforward. Two approaches that use a block cipher to build a PNRG have gained widespread acceptance: the CTR mode and the OFB mode. The CTR mode is recommended in SP , in the ANSI standard X9.82 (Random Number Generation), and RFC The OFB mode is recommended in X9.82 and RFC Stallings Figure 7.3 illustrates the two methods. In each case, the seed consists of two parts: the encryption key value and a value V that will be updated after each block of pseudorandom numbers is generated. In the CTR case, the value of V is incremented by 1 after each encryption. In the case of OFV, the value of V is updated to equal the value of the preceding PRNG block. In both cases, pseudorandom bits are produced on block at a time.

13. Stream Ciphers Generalization of one-time pad
Stream cipher is initialized with short key
Key is “stretched” into long keystream
have a pseudo random property
Keystream is used like a one-time pad
XOR to encrypt or decrypt
A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. In a stream cipher, a key is input to a pseudorandom bit generator that produces a stream of 8-bit numbers that are apparently random. The output of the generator, called a keystream, is combined one byte at a time with the plaintext stream using the bitwise exclusive-OR (XOR) operation. The stream cipher is similar to the one-time pad discussed in Chapter 2. The difference is that a one-time pad uses a genuine random number stream, whereas a stream cipher uses a pseudorandom number stream. But rely on the randomness of stream key completely destroys statistically properties in message. However, you must never reuse a stream key since otherwise you can recover messages (as with a book cipher).

14. Topics One-Time-Pad Random Number Generator Stream Cipher RC4
RC4 and WEP

15. Stream Cipher Structure
Randomness of stream key completely destroys statistically properties in message
Must never reuse stream key
otherwise can recover messages
Stallings Figure 7.5 illustrates the general structure of a stream cipher, where a key is input to a pseudorandom bit generator that produces an apparently random keystream of bits, and which are XOR’d with message to encrypt it, and XOR’d again to decrypt it by the receiver.
Encryption
Using a secret key generate the RC4 keystream using the KSA and PRGA.
Read the file and xor each byte of the file with the corresponding keystream byte.
Write this encrypted output to a file.
Transmit file over an insecure channel.
Decryption
Using the same secret key used to encrypt generate the RC4 keystream.
Read the encrypted file and Xor every byte of this encrypted stream with the corresponding byte of the keystream.
This will yield the original plaintext

16. Stream Cipher Properties
Some design considerations are:
long period with no repetitions
statistically random
depends on large enough key
large linear complexity
Properly designed, can be as secure as a block cipher with same size key
Benefit : usually simpler & faster
[KUMA97] lists the following important design considerations for a stream cipher:
The encryption sequence should have a large period, the longer the period of repeat the more difficult it will be to do cryptanalysis.
The keystream should approximate the properties of a true random number stream as close as possible, the more random-appearing the keystream is, the more randomized the ciphertext is, making cryptanalysis more difficult.
To guard against brute-force attacks, the key needs to be sufficiently long. The same considerations as apply for block ciphers are valid here .Thus, with current technology, a key length of at least 128 bits is desirable.
With a properly designed pseudorandom number generator, a stream cipher can be as secure as block cipher of comparable key length. The primary advantage of a stream cipher is that stream ciphers are almost always faster and use far less code than do block ciphers. A stream cipher can be constructed with any cryptographically strong PRNG.

17. Topics One-Time-Pad Random Number Generator Stream Cipher RC4
RC4 and WEP

18. RC4 Basics A symmetric key encryption algorithm invented by Ron Rivest
A proprietary cipher owned by RSA, kept secret
Code released at the sites of Cyberpunk r ers
Variable key size, byte-oriented stream cipher
Normally uses 64 bit and 128 bit key sizes.
Used in
SSL/TLS (Secure socket, transport layer security) between web browsers and servers,
IEEE wirelss LAN std: WEP (Wired Equivalent Privacy), WPA (WiFi Protocol Access) protocol
RC4 is a stream cipher designed in 1987 by Ron Rivest for RSA Security. It is a variable key-size stream cipher with byte-oriented operations. The algorithm is based on the use of a random permutation. Analysis shows that the period of the cipher is overwhelmingly likely to be greater than 10^100. Eight to sixteen machine operations are required per output byte, and the cipher can be expected to run very quickly in software. RC4 is probably the most widely used stream cipher. It is used in the SSL/TLS secure web protocol, & in the WEP & WPA wireless LAN security protocols. RC4 was kept as a trade secret by RSA Security, but in September 1994 was anonymously posted on the Internet on the Cypherpunks anonymous r ers list. In brief, the RC4 key is ued to form a random permutation of all 8-bit values, it then uses that permutation to scramble input info processed a byte at a time.

19. RC4-based Usage WEP WPA default Bit Torrent Protocol Encryption
Microsoft Point-to-Point Encryption
SSL (optionally)
SSH (optionally)
Remote Desktop Protocol
Kerberos (optionally)

20. RC4 Block Diagram
Secret Key
RC4
Keystream
Encrypted Text
Plain Text +
Cryptographically very strong and easy to implement

21. RC4 …Inside KSA PRGA on the KSA Consists of 2 parts:
Key Scheduling Algorithm (KSA)
Pseudo-Random Generation Algorithm (PRGA)
KSA
Generate State array
PRGA on the KSA
Generate keystream
XOR keystream with the data to generated encrypted stream
KSA
PRGA

22. The KSA
Use the secret key to initialize and permutation of state vector S, done in two steps 1 2
for i = 0 to 255 do
S[i] = i;
T[i] = K[i mod(|K|)]);
j = 0;
for i = 0 to 255 do
j = (j+S[i]+T[i])(mod 256)
swap (S[i], S[j])
[S], S is set equal to the values from 0 to 255
S[0]=0, S[1]=1,…, S[255]=255
[T], A temporary vector
[K], Array of bytes of secret key
|K| = Keylen, Length of (K)
Use T to produce initial permutation of S
The only operation on S is a swap; S still contains number from 0 to 255
After KSA, the input key and the temporary vector T will be no longer used

23. The PRGA Generate key stream k , one by one
XOR S[k] with next byte of message to encrypt/decrypt
i = j = 0;
While (more_byte_to_encrypt)
i = (i + 1) (mod 256);
j = (j + S[i]) (mod 256);
swap(S[i], S[j]);
k = (S[i] + S[j]) (mod 256);
Ci = Mi XOR S[k];
Sum of shuffled pair selects "stream key" value from permutation

24. RC4 Lookup Stage
The output byte is selected by looking up the values of S[i] and S[j], adding them together modulo 256, and then looking up the sum in S
S [S[i] + S[j]] is used as a byte of the key stream, K
i = j = 0;
While (more_byte_to_encrypt)
i = (i + 1) (mod 256);
j = (j + S[i]) (mod 256);
swap(S[i], S[j]);
k = (S[i] + S[j]) (mod 256);
Ci = Mi XOR S[k];

25. Detailed Diagram

26. Overall Operation of RC4

27. Decryption using RC4
Use the same secret key as during the encryption phase.
Generate keystream by running the KSA and PRGA.
XOR keystream with the encrypted text to generate the plain text.
Logic is simple :
(A xor B) xor B = A A = Plain Text or Data B = KeyStream

28. Topics One-Time-Pad Random Number Generator Stream Cipher RC4
RC4 and WEP

29. RC4 key: IV (24) Long-term key (40 or 104 bits)
RC4 and WEP
WEP is a protocol using RC4 to encrypt packets for transmission over IEEE wireless LAN.
WEP requires each packet to be encrypted with a separate RC4 key.
The RC4 key for each packet is a concatenation of a 24-bit IV (initialization vector) and a 40 or 104-bit long-term key.
RC4 key: IV (24) Long-term key (40 or 104 bits) l

30. 802.11 frames using WEP Header IV Packet ICV FCSl
Header IV Packet ICV FCS
encrypted
ICV: integrity check value (for data integrity)
FCS: frame check sequence (for error detection)
Both use CRC32

31. WEP Vulnerability
WEP protocol has several flaws but not the RC4 itself
Short IV length
24 bits IV not sufficient
Clear text IV as part of the key
24 bits of every key in cleartext
Collect and analyze IVs to extract the WEP key
Weak IVs
Some generated IVs do not provide enough randomness
Can be used to extract the key
To form the stream key for en/decryption (which are identical), RC4 continues to shuffle the permutation array S by continuing to swap each element in turn with some other entry, and using the sum of these two entry values to select another value from the permutation to use as the stream key, which is then XOR’d with the current message byte.
A number of papers have been published analyzing methods of attacking RC4, but none of these approaches is practical against RC4 with a reasonable key length, such as 128 bits.
A more serious problem occurs in its use in the WEP protocol, not with RC4 itself but the way in which keys are generated for use as input to RC4.
Currently RC4 its regarded as quite secure, if used correctly, with a sufficiently large key.

32. Q&A